The scan of www.gmx.net on 19 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with www.gmx.net?

1 analysed samples communicate with this URL, including HUILoader.

How was www.gmx.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

www.gmx.net - URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned www.gmx.net and returned a unknown verdict (score -12). The page resolved to 217.72.199.68 on 1&1 Mail & Media GmbH in DE. 32 domains and 2 IPs were contacted, over 8 HTTP requests. 1 malware sample communicates with this URL (HUILoader). The request followed 1 redirect before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://gmx.de/
Domain: www.gmx.net · IP: 217.72.199.68 · AS8560 · DE
Server: nginx
Page title: GMX - kostenlose E-Mail, Cloud, Nachrichten & Freemail
HTTP status: 200 · text/html;charset=UTF-8
TLS issuer: C=DE, O=Deutsche Telekom Security GmbH, CN=Telekom Security ServerID OV Class 2 CA · valid to Nov 22 23: · subject C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Mail & Media GmbH, CN=*.www.gmx.net
Evidenced operator: 1&1 Mail & Media GmbH
HTTP requests captured: 8
Scan tier: fast · observed 2026-08-19 23:23:42 UTC

Redirect chain

https://gmx.de/
https://www.gmx.net/

Malware communicating with this URL (1)

These samples were observed contacting or being served from www.gmx.net. Each links to its full analysis.

HUILoader - referenced · e2a5172986c555b0d9865ac81091961a · first seen 2026-08-19

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Nginx

Contacted infrastructure

217.72.199.68 - AS8560 1&1 Mail & Media GmbH (Germany)
217.72.199.4 - AS8560 1&1 Mail & Media GmbH (Germany)

Observed indicators

www.gmx.net
img.ui-portal.de
www.gmx.at
www.gmx.ch
www.gmx.com
www.gmx.co.uk
www.gmx.es
www.gmx.fr
js.ui-portal.de
dl.gmx.net
s.uicdn.com
i0.gmx.net
vorteile.gmx.net
millionenklick.gmx.net
lotto.gmx.de
gmx.1und1.de
games.gmx.net
gmx.net
octopusenergy.de
www.united-internet-for-unicef-stiftung.de

Questions about www.gmx.net

Is www.gmx.net safe?: The scan of www.gmx.net on 19 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with www.gmx.net?: 1 analysed samples communicate with this URL, including HUILoader.
How was www.gmx.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of www.gmx.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan